Token classification is the first and most consequential legal decision a founding team makes. Get it wrong and a product launch becomes an unregistered securities offering – with the enforcement, restitution and reputational consequences that follow. Get it right and the entire downstream stack – licensing, whitepaper obligations, banking relationships, exchange listings and tax treatment – aligns from day one.
The legal classification of a digital token turns on the substance of the rights it confers, not the label printed on the marketing deck. That principle is consistent across MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities), VARA (Dubai's Virtual Assets Regulatory Authority), the SEC's longstanding application of the Howey test, and FINMA's token taxonomy in Switzerland. Each regime uses different vocabulary, but the analytical core is identical: what does the holder actually receive, and does that resemble an investment contract, a currency, or a consumable access right?
This guide walks through the classification process step by step, from mapping token rights to structuring the legal opinion, with a cross-border note and the common mistake at each stage.
Why Classification Must Come Before Everything Else
Misclassifying a token is not a paperwork error – it is the predicate act for enforcement. Once a token is issued and trading, retroactive reclassification is costly, sometimes impossible, and occasionally criminal. The applicable regime (whether MiCA's CASP authorisation framework, the SEC's securities laws, or VARA's activity-based rulebooks) determines which entity needs which licence, which disclosures must appear in which document, and which jurisdictions are effectively off-limits for marketing.
In our practice, we see the classification conversation deferred more often than any other pre-launch task. Founders treat it as a compliance formality to address after the tokenomics are fixed. That sequencing is precisely backwards. The rights embedded in the token – voting, revenue participation, redemption, access – must be defined before the technical architecture is built, not after. Changing those rights post-issuance to cure a classification problem is far more expensive than designing them correctly from the outset.
A cross-border note applies immediately: the same token may be a security in the United States under the Howey test, an asset-referenced token (ART) under MiCA, and an unregulated utility in a third jurisdiction – simultaneously. A classification that satisfies one regime is not a safe harbour in another. Operators selling to users in multiple regions carry concurrent obligations across all of them.
The standard classification error at this stage is assuming that a decision made in one jurisdiction exports globally. It does not. Classification is jurisdiction-specific, and a clean Swiss FINMA opinion does not immunise the issuer from SEC scrutiny of US-person sales.
Step 1: Map the Rights the Token Actually Confers
The first step is a complete written inventory of every right, expectation and economic interest attached to the token – drafted before any whitepaper language is finalised. Rights fall into four functional categories: economic rights (profit-sharing, dividends, revenue participation, buy-back commitments), governance rights (voting on protocol or business decisions), access rights (consumption of a service or product), and settlement or payment rights (use as a medium of exchange or store of value).
Each category carries distinct regulatory weight. An economic right that resembles a dividend creates the strongest argument for securities treatment across most regimes. A governance right, on its own, is insufficient to trigger securities status in some jurisdictions but sufficient in others – the MiCA regime, for instance, treats tokens with asset-referenced characteristics as ARTs regardless of how the governance label is applied. An access right that can only be consumed (not traded for profit) sits closest to the utility end of the spectrum, but only if that non-tradability is structural, not cosmetic.
The cross-border note at this step: the same right is weighed differently by different regulators. FINMA distinguishes payment, utility and asset tokens based on the primary economic function. The SEC asks whether purchasers invest money in a common enterprise with an expectation of profits from the efforts of others – the Howey test. MiCA applies a category-first approach: is the token an ART, an EMT (e-money token) or an "other crypto-asset"? Each test reaches different conclusions from the same set of facts.
The common mistake at this step is treating the rights inventory as a marketing exercise rather than a legal document. Founders describe what they hope the token will do. The regulator analyses what it actually does. Every right that is technically possible – even if not currently activated – is in scope.
Step 2: Apply the Howey Test and Its Jurisdictional Equivalents
Applying the primary classification tests systematically is the core analytical work of pre-launch legal review, and each test must be run against the rights inventory from Step 1 – not against the whitepaper narrative. The US Howey test asks four questions: is there an investment of money, in a common enterprise, with an expectation of profits, derived from the efforts of others? A token that satisfies all four limbs is a security for SEC purposes, triggering the full weight of US securities law regardless of where the issuer is incorporated.
MiCA's EU regime operates on a category-first basis. A token that stabilises its value by reference to a fiat currency or a basket of assets is an ART or an EMT; the issuer needs authorisation from an NCA (national competent authority) before issuance. A token that does neither is an "other crypto-asset" subject to a lighter whitepaper-and-notification regime – but only if it is not already a financial instrument under MiFID II, in which case MiCA does not apply and the full securities regime does.
FINMA's token taxonomy adds a third axis: payment tokens (no return expectation; used as currency), utility tokens (access to a service), and asset tokens (rights against the issuer similar to equity, bonds or derivatives). Combinations – "hybrid tokens" – are classified by their dominant characteristic at launch, which can shift over time.
The cross-border note: an issuer launching globally must run each test in every material jurisdiction. "Material" means jurisdictions where tokens will be offered to residents, where the issuer or key personnel are located, where the token will be listed, and where the issuer's banking relationships sit. In our cross-border practice, we routinely see projects that passed one test miss another because the secondary-market trading dynamics (creating a profit expectation even in nominally utility tokens) tripped the Howey analysis retroactively.
The common mistake at this step is running only one test – typically the test most favourable to the "utility" conclusion – and treating that as the global answer.
Step 3: Assess Whether a Whitepaper or Offering Document Is Required
Once the classification analysis is complete, the document obligations follow directly from the result. Under MiCA, issuers of "other crypto-assets" (tokens that are neither ARTs, EMTs nor MiFID II financial instruments) must publish a compliant whitepaper notified to the relevant NCA before any offer to the public in the EU. The whitepaper must contain prescribed disclosures – rights conferred, technology, team, risk factors – and must carry a liability statement from the issuer. ART and EMT issuers face a full authorisation requirement before the whitepaper may be published.
If the token is a security in the US, a registered offering or an available exemption (Regulation D, Regulation S, Regulation A+) governs the document requirements. Regulation S, which covers offers made exclusively outside the US to non-US persons, is frequently misapplied; the residence of the purchaser at the time of the offer controls, not the nationality of the issuer.
The cross-border note: a MiCA-compliant whitepaper does not satisfy SEC disclosure requirements, and a Regulation D private placement memorandum does not satisfy MiCA. Issuers marketing into both regions need both documents, drafted to be consistent but legally distinct. Where those documents contain inconsistent statements, the more restrictive representation governs.
In a recent matter, a token issuer based in a European jurisdiction had prepared a detailed MiCA whitepaper but had not restricted US-person access to its public token sale. When the secondary trading volume was analysed, a material share originated from US-resident wallets. The team engaged us to restructure the offering mechanics – geo-blocking, investor declarations, sale round sequencing – before the primary sale closed. The whitepaper was amended to reflect the revised mechanics, and the US-person restrictions were implemented before any regulatory inquiry arose.
The common mistake at this step is treating the whitepaper as the classification instrument. The whitepaper documents the classification conclusion. It does not create it. A whitepaper that describes a token as a utility token does not make it one.
For a scoped assessment of your token's document obligations across the jurisdictions that matter to your offering, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis.
Step 4: Evaluate the Airdrop, Staking and Secondary-Market Position
Token distribution mechanics – airdrops, staking rewards, liquidity mining and secondary-market trading – each carry independent classification risk and must be evaluated separately from the primary issuance. An airdrop that distributes tokens to a large population without a purchase price may avoid the "investment of money" limb of the Howey test, but only if the recipients have no other expectation of profit and the airdrop is not structured as a promotional device for a secondary-market listing. Where the airdrop is explicitly tied to a listing event, regulators have treated it as a disguised public offer.
Staking rewards present a distinct issue. Under most regimes, staking rewards are income at the point of receipt, with the tax treatment varying significantly by jurisdiction – this is addressed as a separate structuring question. More importantly for classification, staking rewards that represent a return on a passive economic stake (rather than compensation for computational work) move the token toward the asset-token / ART end of the MiCA spectrum and toward the investment-contract analysis under Howey.
Secondary-market liquidity is perhaps the most underanalysed factor in pre-launch classification. A token that is functionally non-tradable at launch (because its only use is access to a specific service and no exchange will list it) may be a genuine utility token. The same token, once listed on a major exchange and trading on price speculation, may cross into securities territory in jurisdictions that look at the economic reality of how the token is actually used. VARA's activity-based regulatory model in Dubai, for example, applies different obligations to exchange operators depending on whether the listed token is a regulated virtual asset or not.
The common mistake at this step is designing the primary classification analysis around the issuance mechanics and failing to stress-test it against the secondary-market reality. The question is not only "what are the rights at launch?" but "what will a holder's reasonable expectation be six months post-listing?"
Step 5: Build a Cross-Border Classification Map by Material Jurisdiction
A cross-border classification map is a structured legal opinion that states, for each material jurisdiction, which category the token falls into under the applicable local regime, what obligations that classification triggers, and what residual risk remains. It is not a single-jurisdiction memo appended with a disclaimer. It is a purpose-built matrix that drives the go-to-market decision for each region.
The map should cover, at minimum: the EU (MiCA, with the relevant NCA named); the United States (Howey / Reves analysis, plus state-level money-transmission considerations for tokens that may function as payment instruments); the UAE, distinguishing between VARA's mainland Dubai scope and the ADGM/FSRA regime in Abu Dhabi; Singapore under the Monetary Authority of Singapore's Payment Services Act framework (relevant if the token is a digital payment token); and any jurisdiction where a material portion of anticipated users, team members or service providers are located.
Switzerland under FINMA remains a frequent choice for issuers seeking a clear pre-issuance classification opinion; FINMA's guidance on token taxonomy is well-developed and the process for obtaining a no-action letter (informally) is understood by practitioners. The UK's FCA regime adds a further layer for issuers marketing to UK residents, where financial-promotion rules impose obligations on non-authorised persons who communicate with UK audiences.
The cross-border note: the map is a living document. Regulatory positions on token classification continue to evolve. The SEC's approach to staking, the FCA's implementation of the financial-promotion regime, and MiCA's first authorisation cycles are all generating new guidance that affects conclusions reached under earlier analysis. Operators we advise maintain their classification maps as versioned documents, reviewed at each significant product or distribution change.
The common mistake at this step is treating the cross-border map as a one-time exercise. Token launches are iterative. New features, new markets and secondary-market developments can each alter the classification outcome.
If a prior classification review stalled or produced a conclusion that no longer reflects the product's current state, write to OBOLUS at info@oboluslaw.com. A second read can surface the structural reason and the route forward.
Step 6: Stress-Test the Utility Label Against Regulatory Scrutiny
A common assumption in the market is that labelling a token "utility" in the whitepaper settles the legal classification. It does not – and no regulator in any material jurisdiction has ever accepted that position. Classification turns on substance, not on the marketing term applied by the issuer. This is not a legal technicality; it is the explicit position of ESMA under MiCA, the SEC in its enforcement record, FINMA in its guidance, and VARA in its rulebooks.
The stress test at this step asks the regulator's question, not the founder's question. The regulator asks: if a purchaser bought this token at launch and held it for twelve months, would they reasonably expect to profit from the work of the issuer or protocol team? If the answer is yes for any material portion of the purchaser population – regardless of the whitepaper's characterisation – the token has a securities-exposure problem.
The stress test should be applied across three scenarios: the optimistic scenario (the project succeeds, price rises, holders profit from the team's efforts); the neutral scenario (the token trades flat, holders use it for access only); and the adverse scenario (the project fails, holders have no recourse). In the first and third scenarios, most "utility" tokens reveal economic characteristics that regulators will scrutinise. Only in the neutral scenario – where the token is genuinely consumed rather than held – does the utility classification hold without qualification.
We assess classification against the substance of rights, not the marketing label. That means challenging the founder team's preferred characterisation with the same rigour a securities regulator would apply. Clients who have worked through this process with us consistently identify rights and expectations in their token design that they had not recognised as legally significant.
The common mistake at this step is skipping the stress test entirely on the grounds that the legal opinion already says "utility." The opinion is an input, not the final answer. If the facts change – the product pivots, the tokenomics shift, the secondary market behaves unexpectedly – the opinion must be revisited.
Step 7: Obtain a Formal Classification Opinion and Integrate It Into the Legal Stack
A formal written classification opinion, prepared by qualified digital-asset counsel, is the document that protects the issuer, the directors and the founding team if the classification is later challenged. It demonstrates good-faith reliance on professional legal advice, sets out the analytical basis for the classification conclusion, identifies the residual risks, and provides the framework for the whitepaper disclosures and offering restrictions that flow from that conclusion.
The opinion should be jurisdiction-specific: a single global opinion is rarely appropriate because the tests differ and the conclusions can diverge. In our practice, we structure the opinion as a primary jurisdiction analysis (typically the issuer's home jurisdiction or the jurisdiction of primary offering) with a cross-border schedule addressing each material jurisdiction identified in Step 5.
Integration into the legal stack means that the classification opinion drives – and is explicitly reflected in – every downstream document: the whitepaper, the token sale agreement, the terms of service, the offering restrictions and the exchange listing application. Inconsistency between the classification opinion and the whitepaper is a red flag in any regulatory review. If the opinion classifies the token as a non-security utility token but the whitepaper describes profit expectations and value appreciation, the whitepaper governs the regulatory analysis, not the opinion.
The cross-border note: allied counsel in each relevant jurisdiction should review their respective sections of the cross-border schedule. A single firm opining across all jurisdictions without local-law input on each creates a reliability gap that regulators and sophisticated counterparties will identify.
The common mistake at this step is obtaining the opinion as a formality after the whitepaper is already drafted and the tokenomics are fixed. The opinion should precede and inform those documents, not trail them as a post-hoc rationalisation.
Related at OBOLUS
- Token Offerings & Securities Practice – end-to-end legal structuring for token issuers from classification to listing
- Security Token: A Legal Guide for Digital-Asset Businesses – what makes a token a security and what that triggers in practice
- UAE (VARA Dubai) vs. Switzerland: Where to License a Crypto Business – a jurisdiction comparison for token issuers weighing Dubai against Zug
FAQ
Is my token a security?
Whether a token is a security depends on the rights it confers and the jurisdiction in which it is offered – not on how it is labelled. In the United States, the Howey test asks whether purchasers invest money in a common enterprise expecting profits from others' efforts. Under MiCA, the question is whether the token is a financial instrument under MiFID II, an ART, an EMT or an "other crypto-asset." The same token can be a security in one jurisdiction and unregulated in another. A formal multi-jurisdiction classification opinion is the only reliable answer.
Do I need a MiCA whitepaper?
Issuers of "other crypto-assets" offered to the public in the EU must publish a MiCA-compliant whitepaper notified to the relevant national competent authority before the offer. ART and EMT issuers require full NCA authorisation before publishing. Tokens that qualify as MiFID II financial instruments fall outside MiCA and into the EU securities regime, which carries stricter prospectus requirements. If your token is offered to EU residents – even from a non-EU issuer – the MiCA whitepaper obligations apply. The applicable NCA depends on the member state of the issuer or the state of first offering.
How should an airdrop be structured legally?
An airdrop must be designed so it does not constitute a public offer of securities or an unregistered distribution under the applicable regime. Key variables include whether recipients provide any consideration (monetary or non-monetary), whether the airdrop is linked to a planned secondary-market listing, and whether recipients can reasonably expect to profit from the issuer's efforts. A promotional airdrop tied to an exchange listing is the highest-risk structure. Legal review of the airdrop mechanics – including geo-restrictions, eligibility criteria and disclosure obligations – should precede any public announcement of the distribution.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We assess token classification against the substance of rights, not the marketing label – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token structuring, smart-contract legal analysis and cross-border classification opinions for Web3 issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.